Security best practices

[dibari]

Are there any security best practices you can recommend related to large email size or attachment size? For example, if someone wanted to spam your system with a barrage of emails that have 20MB+ attachment sizes, things would get slow.

[Flolagale]

Right. There is a simplesmtp option to limit the size of the attachments but it is informative only, meaning that a malicious smtp client could send the attachement anyway. So to be clear, there is currently no way to refuse emails with large attachment sizes. Being able to do so is something that I would like to integrate though.

[Flolagale]

Mmm actually we might be able to check the size and refuse the message before receiving it, see https://github.com/andris9/simplesmtp/blob/master/examples/size.js#L18. Let me investigate a bit.

[bjlaur]

So, what is the conclusion on this? It's impossible to refuse attachments that large? We could just cut off the smtp connection, right?